Extracted

Extracted

Extracted

• • Target

    3cb7b21368db29f3eb2dca7288aa62b0ac88e0bbf8363e495bffa0453dbc9e8e

  • Size

    724KB

  • MD5

    a70a7a3368d23144e2ba2cd1c813d496

  • SHA1

    df27cf829e407e8fa0a0cc5b65e66e5e93964841

  • SHA256

    3cb7b21368db29f3eb2dca7288aa62b0ac88e0bbf8363e495bffa0453dbc9e8e

  • SHA512

    ece447235892960c831e8ba0c58ac99462a3d75bc707e11fa470efed75cf2287ef955640aa181eeb36a0da05c2f4e6885f727a14967dbfed1cfbff463db2b71e

  • SSDEEP

    12288:oMrey9081MqdOoNlZKAYxGTT4hqGjFJ43BhcNNnRJ6BnmU83YPH:WyjqqdO2KAHTTevjFJ4LcfU2kH

  Score

  10^/10

  amadeyredlinefukiarumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1